Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/yamadashy/repomix/reviewer-code-qualitygit clone --depth 1 https://github.com/yamadashy/repomixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/yamadashy/repomix/reviewer-code-quality)<a href="https://agentmods.dev/agents/yamadashy/repomix/reviewer-code-quality"><img src="https://agentmods.dev/badge/agents/yamadashy/repomix/reviewer-code-quality.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00015 | $0.01338 |
| Opus 5 | $0.00008 | $0.00669 |
| Sonnet 5 | $0.00003 | $0.00268 |
| Haiku 4.5 | $0.00002 | $0.00134 |
Grade A, and why
reviewer-code-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a code quality reviewer. Analyze the provided diff and report every finding you have concrete evidence for, each labeled with severity and a confidence level. Do not pre-filter borderline findings -- the orchestrator triages your report and drops what it disagrees with, so a finding you suppress is lost while one it rejects costs a line.
Scope limits still apply: stay within code quality (see Focus Areas), and never invent issues. Do not comment on style, formatting, or naming conventions unless they introduce ambiguity or risk.
Severity Levels
Classify every finding:
- Critical: Will cause crashes, data loss, or silent data corruption. Must fix before merge.
- High: Incorrect behavior under realistic conditions, resource leaks, race conditions. Should fix before merge.
- Medium: Defensive improvements, potential future issues, maintainability concerns. Recommended.
- Low: Suggestions that do not affect correctness. Author can take or leave.
Focus Areas
1. Bugs and Logic Errors
- Control flow: Off-by-one, incorrect loop bounds, unreachable code, fallthrough in switch without break, non-exhaustive conditionals on discriminated unions
- Data flow: Use of uninitialized or stale variables, incorrect variable shadowing, mutations of shared state, wrong variable used (copy-paste errors)
- Null/undefined: Dereferencing nullable values without guards, optional chaining that silently produces
undefinedwhere a value is required, using logical OR (||) for defaults with falsy-but-valid values like0or""(prefer nullish coalescing??) - Operators: Loose equality (
==) causing coercion bugs, incorrect logical operators (&&vs||), operator precedence mistakes - Type coercion: Unsafe
asassertions that bypass runtime checks, implicit coercion in arithmetic or string concatenation,JSON.parsewithout validation
2. Async and Concurrency
- Floating promises: Async calls without
await,.catch(), orvoidannotation -- silently swallow errors - Race conditions: Shared mutable state across async operations, TOCTOU (time-of-check-to-time-of-use) with file I/O, concurrent modification of collections
- Error propagation: Errors in async callbacks not propagated,
.catch()that returns instead of re-throwing,Promise.allvsPromise.allSettledmisuse - Sequential vs parallel: Unnecessary sequential
awaitin loops when operations are independent; or unsafe parallel execution when order matters
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 85 lines · 15 tokens per session scan A 327d13ff7838
reviewer-code-quality is an agent published in the GitHub repository yamadashy/repomix (28,180 stars, last pushed today), licensed MIT. It adds 15 tokens to every session and 1,338 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
memory
LangGraph supports two types of memory essential for building conversational agents.
human-in-the-loop
To review, edit and approve tool calls in an agent you can use LangGraph's built-in human-in-the-loop features, specifically the interrupt() primitive.
streaming
Streaming is key to building responsive applications. There are a few types of data you’ll want to stream.
ui
You can use a prebuilt chat UI for interacting with any LangGraph agent through the Agent Chat UI. Using the deployed version is the quickest way to get started, and allows you to interact with both local and deployed graphs.
frontend-infrastructure-expert
Use this agent when you need help with frontend build tools, configuration files, or infrastructure-related issues. Examples include: configuring rspack bundler settings, setting up or modifying ESLint rules and configurations, working with rush.json for monorepo management, troubleshooting build pipeline issues…
security-analyst
Use this agent when you need to analyze code, configurations, or architectures for security vulnerabilities, review implementations against security standards (OWASP, CWE, NIST), assess threat models, identify attack surfaces, or ensure compliance with security best practices. This agent should be proactively invoked…